CVE-2026-72900 in Metabase
Summary
by MITRE • 08/10/2026
Metabase allows an authenticated, low-privileged attacker to read the entire Metabase application database.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability represents a critical access control flaw that enables authenticated users with minimal privileges to gain unauthorized access to the complete Metabase application database. The issue stems from insufficient authorization checks within the application's data access mechanisms, allowing attackers who have established legitimate authentication credentials to bypass normal security boundaries and extract all database contents. Such a vulnerability directly violates fundamental security principles of least privilege and principle of least authority, where users should only have access to resources necessary for their specific role or function. The flaw likely exists in the application's query execution or data retrieval components where proper permission validation fails to occur before database access is granted.
The technical implementation of this vulnerability typically involves a misconfiguration in the application's access control layer where user roles and permissions are not properly enforced during database operations. Attackers can exploit this by crafting specific requests that bypass normal access controls, potentially leveraging SQL injection techniques or by directly accessing database endpoints that should be restricted to administrators or higher-privileged users. This type of vulnerability is categorized under common weakness enumeration CWE-285 which deals with improper authorization in applications, and aligns with attack techniques described in the attack pattern taxonomy such as privilege escalation and data exposure. The vulnerability may also relate to CWE-798 which covers the use of hard-coded credentials or insecure configurations that allow unauthorized access.
The operational impact of this vulnerability is severe and far-reaching for organizations using Metabase, as it provides attackers with complete access to all application data including user information, query results, dashboards, and potentially sensitive business intelligence. This exposure can lead to data breaches, intellectual property theft, and compliance violations that may result in significant financial and reputational damage. Organizations could face regulatory penalties under frameworks such as gdpr, hipaa, or pci dss depending on the nature of the data accessed. The vulnerability also enables attackers to potentially escalate their privileges further by examining user credentials stored within the database or identifying additional attack vectors through exposed configuration information.
Mitigation strategies should focus on implementing robust access control mechanisms that enforce proper authorization checks at every database interaction point. Organizations must ensure that all database queries validate user permissions before execution and implement role-based access controls with granular permissions. Regular security testing including penetration testing and code reviews should be conducted to identify such authorization flaws. Additionally, organizations should implement database activity monitoring and logging to detect unauthorized access attempts. The fix typically involves strengthening the application's permission validation logic, implementing proper input sanitization, and ensuring that all database operations are properly scoped to user privileges as defined in the application's security model. This vulnerability highlights the critical importance of defense in depth principles where multiple layers of security controls work together to protect sensitive data assets from unauthorized access attempts.